Update authentication middleware to special-case index urls

[zanieb]

As discussed in #4056, pip makes a keyring request for credentials for the index url but we make a request for the package url and the index url host name which for some plugins (e.g. Azure #3542) does not seem to work.

We should update the authentication handling to be aware of the user-provided index urls and, when we see a url that is a child of an index url, attempt to fetch credentials for the index url either after or instead of the package url.